From da1640d5a1aa8e3bbbab11423d79badeb2fbeeb8 Mon Sep 17 00:00:00 2001
From: Günther Deschner <gd@samba.org>
Date: Sat, 24 Sep 2005 11:33:55 +0000
Subject: r10474: We better ignore builtin SIDs from the Active Directory DC to
 prevent that AD's builtin groups mixup with our own builtin groups.

Guenther
(This used to be commit 9930013161f1ae59e7aed1b397b79792d384f1ba)
---
 source3/nsswitch/winbindd_ads.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/source3/nsswitch/winbindd_ads.c b/source3/nsswitch/winbindd_ads.c
index 7851fdabc3..eda6dea2c4 100644
--- a/source3/nsswitch/winbindd_ads.c
+++ b/source3/nsswitch/winbindd_ads.c
@@ -613,9 +613,16 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 
 	add_sid_to_array(mem_ctx, &primary_group, user_sids, num_groups);
 	
-	for (i=0;i<count;i++)
+	for (i=0;i<count;i++) {
+
+		/* ignore Builtin groups from ADS - Guenther */
+		if (sid_check_is_in_builtin(&sids[i])) {
+			continue;
+		}
+			       
 		add_sid_to_array_unique(mem_ctx, &sids[i],
 					user_sids, num_groups);
+	}
 
 	status = (user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
 
-- 
cgit